Having worked in Business Continuity Management (BCM) and Operational Resilience across the United Kingdom and Asia, I have had the opportunity to support a diverse range of organisations, from fintech start-ups operating with limited resources to large multinational corporations with mature governance structures and highly formalised processes.
Across these organisations, one observation has remained remarkably consistent: success in resilience is not only determined by the quality of frameworks, policies, or technology alone. Instead, the most significant differentiator is often something less tangible and more difficult to measure, organisational culture.
As Business Continuity and Resilience professionals, we are trained in established methodologies and professional practices. We conduct Business Impact Analyses, develop continuity plans, perform exercises, manage risks, and work diligently to ensure our organisations are prepared for disruption.
Today, the discipline of resilience extends far beyond traditional BCM. It encompasses Operational Resilience, Third-Party Risk Management, Incident and Crisis Management, Cyber Resilience, and a growing range of interconnected capabilities. Yet despite this evolution, culture often remains a secondary consideration in many programmes.
Capability versus Compliance
Many organisations possess what appears to be a robust resilience programme. They have documented policies, governance committees, annual tests, and extensive reporting mechanisms. On paper, they appear well prepared.
However, true resilience reveals itself during disruption.
When systems fail, suppliers are unavailable, cyber incidents unfold, or operational processes are stretched beyond their designed limits, organisations do not rely solely on documented procedures. They rely on people.
The difference between a programme that merely achieves compliance and one that demonstrates genuine capability often comes down to how people think, collaborate, communicate, and respond under pressure. These behaviours are products of culture.
A strong resilience culture encourages employees to identify emerging risks, escalate concerns early, collaborate across organisational silos, and focus on solving problems rather than assigning blame. In contrast, a weak culture can render even the most sophisticated continuity programme ineffective.
Influencing Culture Through Stories and Shared Learning
One of the challenges in building resilience culture is that culture itself can feel abstract. It is difficult to measure and even harder to change through policy alone.
Throughout my career, I have found that culture is often influenced more effectively through storytelling, awareness, and shared experiences than through formal documentation.
I have used examples from incidents experienced by peer organisations, combined resilience discussions with related topics such as health and safety, physical security, and cyber security, and shared lessons learned from previous organisations to broaden perspectives.
One of my favourite examples comes from the film Apollo 13, which recounts the extraordinary efforts made by NASA and the spacecraft crew to overcome a life-threatening systems failure in space.
What makes the story compelling is not simply the technical ingenuity involved. The mission succeeded because individuals across multiple teams united around a common objective. Faced with circumstances for which no contingency plan existed, they improvised, collaborated, tested solutions, adapted rapidly, and remained relentlessly focused on bringing the astronauts home safely.
This embodies resilience in practice.
No procedure could have anticipated every challenge encountered during the mission. The successful outcome was driven by a culture that empowered people to think critically, work together, and innovate under pressure.
As management thinker Peter Drucker is often credited with saying, “Culture eats strategy for breakfast.” Whether or not he actually coined the phrase, its relevance to resilience remains undeniable.
A resilience strategy is important. A resilience culture is what allows it to succeed.
When Two Cultures Collide
One of the most challenging examples of culture’s impact on resilience occurred during my time at a financial start-up.
The organisation’s workforce consisted largely of two groups:
- Experienced professionals from established financial institutions; and
- Technology specialists from fintech and start-up backgrounds.
The financial services professionals brought discipline, governance, regulatory awareness, and a strong appreciation for risk management.
The technology teams brought innovation, agility, experimentation, and a “fail fast and learn” mindset.
Individually, both approaches had tremendous value. Both teams had much to learn from the other side to ensure the organisation was able to operate successfully.
Financial Services requires stability, robust controls, and adherence to regulatory expectations. At the same time, a digital startup must innovate rapidly to remain competitive and deliver value to customers.
Into this environment add significant regulatory pressure.
In 2022, the Hong Kong Monetary Authority (HKMA) issued updated guidance on Business Continuity Planning (TM-G-2) and introduced its Operational Resilience framework (OR-2) with expectations that these requirements be addressed within a highly demanding timeframe.
Building a resilience programme was only part of the challenge.
The greater challenge was fostering a shared understanding that resilience was not solely a compliance obligation or a technology concern. It was a collective responsibility requiring the organisation to combine their strengths.
Only when people began focusing on the common objective, rather than defending their respective approaches, was meaningful progress achieved.
The Emperor’s Physician
In recent years, I have increasingly relied on a story from ancient China to explain resilience culture.
The story is commonly known as The Parable of the Emperor’s Physician, often attributed to the legendary physician Bian Que.
The Emperor once asked a renowned physician which of three brothers was the most skilled.
The physician replied:
“My eldest brother is the best physician. He recognises illness before symptoms appear and prevents disease entirely. Because his patients never become sick, nobody notices his work.”
“My middle brother is the second best. He treats illnesses at their earliest signs, before they develop into something serious. People think he only cures minor ailments.”
“As for me, I am the least skilled. I treat severe diseases using invasive procedures and powerful medicines. Because people witness dramatic recoveries, my reputation has spread throughout the kingdom.”
The Emperor immediately understood the lesson:
Prevention is better than cure.
For resilience professionals, the analogy is particularly powerful.
The first brother represents proactive resilience.
His work is invisible because success means problems never occur.
This is the HR team recruiting capable staff, procurement teams selecting resilient suppliers, legal teams strengthening contractual protections, architects designing resilient systems, and risk managers identifying vulnerabilities before they become incidents.
The second brother represents early intervention.
These are the teams monitoring service levels, tracking operational performance, managing capacity, analysing risk indicators, and resolving issues before they escalate into major disruptions.
The third brother represents crisis response.
This is where many organisations focus most of their attention because visible incidents and dramatic recoveries attract recognition. Crisis management, incident response, and disaster recovery are essential capabilities, but they are also the most costly and stressful stages of the resilience lifecycle.
The ultimate goal should be to spend more time acting like the first brother and less time being forced to act like the third.
Resilience Is Everyone’s Responsibility
The most resilient organisations are not necessarily those with the largest BCM teams, the most comprehensive policy libraries, or the most sophisticated technology.
They are organisations where resilience has become part of everyday decision-making.
Employees understand their role in protecting critical services. Leaders consider resilience impacts when making strategic choices. Problems are escalated early. Lessons are shared openly. Collaboration is valued over blame.
In these organisations, resilience is not something that resides within a specialist function.
It becomes part of the organisational DNA.
As resilience professionals, we often focus on frameworks, controls, plans, and regulatory requirements. These are all essential components of success. However, if we truly want to enhance organisational resilience, we must pay equal attention to the behaviours, values, and mindset that underpin them.
After all, plans can be written, technologies can be purchased, and regulations can be complied with.
Culture must be built.
And when disruption inevitably occurs, culture is often what determines whether an organisation merely survives or genuinely thrives.
Resilience & Crisis Management Practitioner, Financial Services, Hong Kong
Daniel Cheung MSc, CBCLA, MBCP
